# Ubuntu patches XZ Utils memory corruption flaw across all supported releases

> **Key takeaway:** Ubuntu has released security updates for XZ Utils fixing a memory allocation failure that could lead to denial of service or arbitrary code execution when processing crafted compressed files.

**Published:** 2026-10-20T17:45:10+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/ubuntu-patches-xz-utils-memory-corruption-flaw-across-all-su.html 

## Summary
Ubuntu Security Notice USN-8945-1 addresses a vulnerability in XZ Utils where memory allocation failures during decoder reinitialization for specific compressed formats could be exploited. The flaw affects all currently supported Ubuntu releases from 14.04 LTS through 26.10. Patched versions are available immediately for supported releases; older LTS versions require Ubuntu Pro or Legacy Support add-on access.

## Affected versions and fixes
- **Root cause**: Incorrect handling of memory allocation failures when reinitializing decoders for specific compressed file formats
- **Impact**: Invalid memory write leading to denial of service or arbitrary code execution
- **Attack vector**: Specially crafted compressed files processed under certain conditions
- **Patched versions**: 5.8.3-1ubuntu1 (26.10), 5.8.3-1ubuntu0.1 (26.04 LTS), 5.6.1+really5.4.5-1ubuntu0.4 (24.04 LTS), 5.2.5-2ubuntu1.2 (22.04 LTS)
- **ESM/Pro required**: 20.04 LTS and older need Ubuntu Pro; 16.04 LTS and 14.04 LTS additionally need Legacy Support add-on
- **Launchpad bug**: LP#2170056

## Why it matters
XZ Utils is a foundational compression library used across Linux distributions and embedded systems. The broad version coverage in this USN reflects the library's long deployment tail and the criticality of maintaining security updates for infrastructure components with wide transitive dependency chains.